Your home network

A home network is a small version of every network in this course. It has a link to the outside world, a border where your private addresses meet the public internet, a local segment where your devices talk to each other, and a radio that stretches that segment through the air. In an office each of those is a separate machine in a rack. At home they are usually squeezed into one or two boxes, which is why it's hard to tell them apart.

It helps to name the jobs before naming the boxes:

• Modem or ONT. Turns whatever your ISP's line carries (radio frequencies on coax, tones on a phone line, pulses of light on fiber) into ordinary Ethernet. It makes no decisions about addresses.
• Router. Sits on the border between your network and the ISP's. It decides where each packet goes next, and at home it also does NAT, runs the DHCP server, forwards DNS questions, and keeps a firewall.
• Switch. Gives you more Ethernet ports on the same network and delivers each frame only to the port it's meant for.
• Access point. A switch port made of radio. It carries the same local network over Wi-Fi.
• Mesh. Several access points that cooperate, so one network name covers the whole house.

The layer model from Chapter 01 sorts them neatly. The modem works at layers 1 and 2: signals and frames. The switch and the access point work at layer 2: they read MAC addresses and nothing else. The router is the first box that reads IP addresses, layer 3, and because it does NAT it also reads and rewrites port numbers, which belong to layer 4. That one fact explains most of what follows: only the boxes that work at layer 3 change your packet's IP header. The others just carry it.

Your ISP's cable doesn't carry Ethernet. Cable internet runs over the same coax as cable TV, using a standard called DOCSIS that packs data into radio-frequency channels. DSL uses high-frequency tones on a telephone pair. Fiber uses light, and on most home fiber the box on your wall is an ONT, an optical network terminal, that speaks a passive optical network standard such as GPON, where one fiber from the street is split among a few dozen homes. Fixed wireless and 5G home internet use a radio on the roof or the windowsill.

Whatever the medium, the job is the same: a modem (modulator-demodulator, the old name from the dial-up days) turns the line's signal into Ethernet frames on one side and back again on the other. It is a translator between two physical worlds. It doesn't route, it doesn't hand out private addresses, it doesn't block anything. If you plug a single computer straight into a plain modem, that computer asks the ISP for an address by DHCP, gets the public address, and is directly on the internet with nothing in front of it.

That's why a modem is almost always followed by a router. The router plugs into the modem with its WAN port (wide area network, "the outside"), gets the public address from the ISP, and builds your private network on its LAN ports.

A home router is the busiest box in the house. Strictly, "routing" is only the first of its jobs. The others ride along because the router is the one place every packet to and from the internet has to pass.

1. Routing. Your router's routing table is tiny. It has one route for the local network ("192.168.1.0/24: deliver directly on the LAN") and one default route ("everything else: send to the ISP"). That's the whole table. Chapter 10 shows what a big one looks like.
2. NAT. Your devices have private addresses from RFC 1918 ranges like 192.168.0.0/16, which are not allowed on the public internet. On every outgoing packet the router swaps your device's address and port for its own public address and a port of its choosing, and writes the swap in a table so it can undo it when the reply comes back. Chapter 07 is all about that table.
3. DHCP server. It lends every device that joins an address, the mask, the default gateway (itself) and a DNS server (usually itself again). Chapter 04 walks the four-message exchange.
4. DNS forwarder. It accepts your devices' name lookups, passes them to the ISP's resolver or whichever one you configured, and caches the answers.
5. Firewall. It lets replies to conversations you started come back in, and drops anything that arrives unasked. On IPv4 the NAT table does much of this by accident, since an unsolicited packet has no table entry to match. A real stateful firewall does it on purpose, and it's what protects you on IPv6, where there's usually no NAT at all.

Most routers also contain a small switch, typically four LAN ports, and one or two Wi-Fi radios. So "the router" in everyday speech is really router, switch and access point together. The thing to keep straight is which of those jobs is happening where, because the router part is the only part that changes addresses.

Inside your network, devices talk to each other with Ethernet frames addressed by MAC address, as Chapter 02 explains. A switch learns which MAC address lives behind which port by watching the source address of every frame that arrives, and from then on sends each frame only out the right port. It never looks at IP addresses. A cheap unmanaged five-port switch behind your TV is just a way to turn one wall jack into four, and every device plugged into it is on exactly the same network as everything else.

An access point does the same thing with radio. Your laptop sends an 802.11 frame through the air; the access point receives it and re-sends the same data as an Ethernet frame on its wired side, and the reverse for traffic coming back. That makes it a bridge between two kinds of layer 2. Your laptop's IP address, the router's address, the TTL: none of it changes. A device on Wi-Fi and a device on a cable, both behind the same router, are neighbors on one subnet.

A mesh system is several access points that coordinate. One unit, the main one, usually also acts as the router. The others, satellites or "points," connect back to it either by cable or by Wi-Fi itself (the backhaul), and they all broadcast the same network name, so your phone can roam from one to the next. Mesh points are bridges too: adding a third or fourth one never adds another NAT, only more coverage.

The trouble starts when a box that could be a router is installed where only a bridge was needed. Most mesh kits and retail routers come out of the box in router mode, with NAT and a DHCP server switched on. Put one behind an ISP gateway that's also in router mode and you get two routers in a row. Most of these products offer a "bridge mode" or "access point mode" that turns their router functions off, and that, or turning the ISP gateway's off instead, is usually the fix.

Wi-Fi is radio, and the physics deserves a whole chapter. The companion site already has one: waves.jelia.nyc/2-4-ghz walks through what a 2.4 GHz wave is, why water and walls absorb it, and how antennas send it. Here is the network engineer's short version.

Three bands. Home Wi-Fi uses the 2.4 GHz band, the 5 GHz band and, with Wi-Fi 6E and Wi-Fi 7 equipment, the 6 GHz band. Each band is divided into channels. Two networks on the same channel take turns using the air; two on overlapping channels interfere with each other in a messier way.

2.4 GHz is crowded. Its channels are only 5 MHz apart, but a Wi-Fi signal is about 20 MHz wide, so neighboring channel numbers overlap. In North America that leaves 1, 6 and 11 as the only three that don't. Microwave ovens, Bluetooth and every neighbor's router share the same small slice. In exchange, 2.4 GHz reaches farther and gets through walls better.

5 GHz and 6 GHz are roomy. Far more channels, and they can be bonded into wider ones (40, 80, 160 MHz, and 320 MHz in Wi-Fi 7 at 6 GHz) for more speed. The price is range. Higher frequencies generally lose more of their strength going through walls, floors and furniture, so a 5 GHz signal that's excellent in the same room may be weak two rooms away. Some 5 GHz channels, the DFS channels, are shared with weather and military radar, and a router using them must listen for radar and move off if it hears any.

Why walls matter. Signal strength falls off with distance even in open air, and every wall takes another bite. Drywall takes a little, brick and concrete a lot, metal, mirrors and foil-backed insulation nearly everything. A water heater or a fish tank in the way is a surprisingly good shield. That's the whole case for mesh: rather than one loud radio shouting through four walls, put a quieter one in each part of the house.

Both are layer 2; both carry exactly the same IP packets. The difference is in how predictable the trip is.

• Speed. Gigabit Ethernet (1000BASE-T) delivers close to its full 1 Gb/s over up to 100 meters of Cat 5e cable, in both directions at once, every time. Wi-Fi's real speed depends on distance, walls, channel width and how many other devices are taking turns.
• Latency and jitter. A wired hop to the router takes well under a millisecond. Wi-Fi adds a few milliseconds, and more importantly the delay varies (jitter) because of backoff and retransmissions. Video calls, games and remote desktop feel jitter more than they feel raw speed.
• Loss. Wi-Fi quietly retransmits lost frames at layer 2, which hides loss as delay. When the signal is marginal, that shows up as stutter.
• Sharing. Each switch port is its own link. Every device on a Wi-Fi channel shares one.

The rule of thumb: anything that doesn't move and is near a jack should be wired, especially a desktop, a game console, a TV, a NAS, and above all the link between mesh points. Wi-Fi is for things that move. If you can't run cable, powerline and MoCA (Ethernet over the coax already in your walls) adapters are worth a look; they are bridges too, so they add no NAT.

Three commands tell you most of what you need: your address, your default gateway, and the first few routers out of the house.

Your address and gateway. On Windows, open a terminal and run ipconfig. Find the adapter you're actually using (Wi-Fi or Ethernet; ignore the virtual ones for now, Chapter 12 deals with them) and read three lines:

On Linux, ip addr shows addresses and ip route shows the gateway in a line like default via 192.168.86.1 dev wlan0. On macOS, ipconfig getifaddr en0 prints the Wi-Fi address and route -n get default prints the gateway. The default gateway is your router's LAN address: the first box that will change your packets.

The first hops out. Now ask every router on the way out to identify itself. On Windows, tracert -d -h 5 example.com (-d skips name lookups so it's faster, -h 5 stops after five hops); on macOS or Linux, traceroute -n -m 5 example.com. Each line is one router, found by sending packets with TTL 1, then 2, then 3, and listening for the "time exceeded" messages that come back.

Read the addresses, not the times. Hop 1 is your own router. Then count how many hops in a row have private addresses: 10.x.x.x, 172.16–31.x.x or 192.168.x.x. One private hop is normal. Two private hops, as above, mean a router behind a router: double NAT. A hop in 100.64–127.x.x right after them points to carrier-grade NAT. The first public address is the ISP's side of the border. Notice what never shows up: the switch, the access point and the mesh points. They don't touch TTL, so traceroute can't see them.

Double NAT is easy to create and easy to miss, because ordinary browsing works fine through it. Every outbound connection gets translated twice and the replies find their way back through both tables. The problems only show up when something needs to come in, or when two devices want to find each other directly.

The symptoms, in roughly the order people notice them:

• Two private hops in a traceroute, like 192.168.86.1 then 192.168.1.1.
• A private WAN address on your router's status page.
• Port forwarding "doesn't work." You set it up on your router, but the outside world only reaches the ISP gateway, which has no matching rule. You'd need a forward on both.
• Automatic port mapping fails. Game consoles and peer-to-peer apps ask the router to open a port with UPnP, NAT-PMP or PCP. Your router opens it, but only on its own NAT; the gateway in front never hears about it. Apps report "strict" or "type 3" NAT.
• Devices on the two networks can't see each other. A printer or TV plugged into the ISP gateway lives on 192.168.1.x; your laptop on the mesh is on 192.168.86.x. Discovery that relies on broadcast or multicast, like casting and printer sharing, can't cross the router between them.
• Peer-to-peer links fall back to relays. Tools that try to connect two devices directly, as video calls, games and Tailscale do, have a harder time punching through two NATs and more often end up relaying traffic through a server, which adds delay.

That last one is the case that started this site. A Windows laptop on a mesh network at 192.168.86.x, behind an ISP gateway at 192.168.1.x, kept retrying NAT-PMP port-mapping requests, and its Remote Desktop sessions over Tailscale ran through a DERP relay instead of the direct path. Every screen update made a round trip through a distant server. The fixes are the same as for any double NAT: put one of the two boxes in bridge or access-point mode so only one does NAT, or, if the ISP box can't be bridged, use its "IP passthrough" or DMZ setting to hand everything to your router. Chapter 08 takes it apart properly, and Chapter 09 explains the direct-versus-relay decision.